[GH-ISSUE #43] Database backed tokens #34

New issue

Closed

opened 2026-02-26 03:33:32 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 03:33:32 +03:00

Owner

Originally created by @laurivosandi on GitHub (Feb 26, 2018).
Original GitHub issue: https://github.com/laurivosandi/certidude/issues/43

Currently hashing algorithm is used for tokening systems. Not having to save stuff to database is a pro of this approach, but if server's secrets are compromised attacker can generate a valid token. Also such token can be reused.

Certidude should support a database backed token system where token identifier is genuinely random and relevant information is looked up on the server side from the database.

Originally created by @laurivosandi on GitHub (Feb 26, 2018). Original GitHub issue: https://github.com/laurivosandi/certidude/issues/43 Currently hashing algorithm is used for tokening systems. Not having to save stuff to database is a pro of this approach, but if server's secrets are compromised attacker can generate a valid token. Also such token can be reused. Certidude should support a database backed token system where token identifier is genuinely random and relevant information is looked up on the server side from the database.